codeql

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text can influence the required workflow’s ingestion surface because it discovers existing CodeQL databases by scanning the filesystem for codeql-database.yml marker files inside $OUTPUT_DIR/project root and then runs CodeQL analysis over the resulting database artifacts (e.g., extraction diagnostics and SARIF) that originate from that tenant/codebase, before any user selection of a specific content item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill includes runtime commands that download and install external CodeQL query/model packs (e.g., "codeql pack download trailofbits/cpp-queries" and "codeql pack download GitHubSecurityLab/CodeQL-Community-Packs-" and the linked GitHub repo https://github.com/GitHubSecurityLab/CodeQL-Community-Packs), which will fetch remote query code that the tool then executes as part of analysis, so remote content can control analysis behavior and run code at runtime.